Instagram OSINT – A Promising New Python Tool

I came across a new Instragram scraping tool InstagramOSINT after DutchOsintGuy and Hwosint pointed it out on Twitter. I’ve stopped using InstaLooter since it kept causing dependency issues, and I started using InstaScraper as a photo grabbing tool.

InstagramOSINT is more than a photo-scraping tool. It’s very new but it gets additional information via the Instagram API including username, profile name, bio, whether the account joined recently, whether it is connected to a Facebook account, and whether or not the account is verified. I’ve played around with it a little today and it looks like quite a useful tool to have in your OSINT kitbag.

Installation

I installed and ran InstagramOSINT on Linux Mint 19.1 with Python 3.6. It threw an error when I ran it but it still worked anyway. I’m not sure if this is just a bug or my setup. If you haven’t run Python tools for OSINT before, I recommend having a read of my guide to setting up and running a Linux virtual machine for OSINT.

In the terminal, install with git as follows:

$ git clone https://github.com/sc1341/InstagramOSINT

 

Change to the InstagramOSINT directory:

$ cd InstagramOSINT

 

Then simply point Python at the main.py script:

$ python main.py -h

 

This brings up the help menu, which tells you about the only running option there is currently:

$ python main.py --username TARGET_USERNAME

 

First Use

I decided to carry out a test run at an unofficial Manchester United Instagram account @manutd (not the official account, someone just got in there really fast and grabbed the Instagram handle while they could.)

The syntax to query the account was as follows:

python main.py --username manutd

The script runs and grabs all the images first. This took a while as even though only 13 images had been posted on the account, InstagramOSINT obtains all available resolutions of the image and saves them to a directory in the InstagramOSINT folder.

In addition to the images, the tool also creates two text files. Posts.txt obtains all the data about each post, while data.txt contains a lot of information about the account. The raw text format is outputted to the terminal:

And also as a raw text file:

It’s hard to read and analyse as a text file, but it can easily be converted into a nice tidy JSON format at JSONViewer. This is the output when tidied up a little:

Quite a useful little tool. It’ll be interesting to see how it develops as time goes by.